PT-2026-31751 · Juniper Networks · Jdhcpd+1

Published 2026-04-09 · Updated 2026-04-14 · CVE-2026-33782

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 22.4R3-S1 Junos OS versions 23.2 prior to 23.2R2 Junos OS versions 23.4 prior to 23.4R2

Description A memory leak in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS on MX Series can be triggered by an adjacent, unauthenticated attacker, leading to a Denial-of-Service (DoS). This occurs in DHCPv6 over PPPoE or DHCPv6 over VLAN scenarios with Active lease query or Bulk lease query, where each subscriber logout leaks a small amount of memory. Exhaustion of available memory causes jdhcpd to crash and restart, resulting in service disruption. Memory usage can be monitored using the command show system processes extensive | match jdhcpd.

Recommendations Update to Junos OS version 22.4R3-S1 or later. Update to Junos OS version 23.2R2 or later. Update to Junos OS version 23.4R2 or later.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-33782

Affected Products

Junos

Jdhcpd

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-33782 · Security Note
• https://kb.juniper.net/JSA107820 · Vendor Advisory
• https://twitter.com/CVEnew/status/2042364304335237607 · Twitter Post
• https://twitter.com/CCBalert/status/2044114655749030191 · Twitter Post